Which is most likely due to the fact that we're validating againt IP_PROTOCOL_MAP from neutron-lib, which doesn't include IP, just upper-layer protocols.
A fix for IP-in-IP, or more generally, IPvX-in-IPvX, would take an investigation to determine what the iptables and OVS support is for it and how to program it into the ruleset. We'd also have to check that conntrack supports it.
The actual error is:
ValueError: Field value 4 is invalid
Which is most likely due to the fact that we're validating againt IP_PROTOCOL_MAP from neutron-lib, which doesn't include IP, just upper-layer protocols.
A fix for IP-in-IP, or more generally, IPvX-in-IPvX, would take an investigation to determine what the iptables and OVS support is for it and how to program it into the ruleset. We'd also have to check that conntrack supports it.